hippo-memory 1.58.0 → 1.60.0

package/dist/rerankers/index.js

@@ -1,7 +1,10 @@
+import { clefFlashReranker, clefReranker } from './clef.js';
 import { crossEncoderReranker } from './cross-encoder.js';
 import { jevReranker } from './jev.js';
 import { llmReranker } from './llm.js';
 const REGISTRY = {
+    clef: clefReranker,
+    'clef-flash': clefFlashReranker,
     'cross-encoder': crossEncoderReranker,
     jev: jevReranker,
     llm: llmReranker,

package/dist/rerankers/jev.d.ts

@@ -1,7 +1,20 @@
-import type { RerankerFn } from './types.js';
+import type { RerankerFn, RerankResult } from './types.js';
+import type { SearchResult } from '../search.js';
 export declare const JEV_DEFAULT_TOP_K = 40;
+/** The System One `state` and one `noul` question per candidate (`c1`..`cN`). */
+export interface RelevanceRequest {
+    state: string;
+    questions: Record<string, {
+        type: 'noul';
+        instructions: string;
+    }>;
+}
+/** Redacted query plus numbered, redacted, truncated candidates. Shared with CLEF so both arms see matched input. */
+export declare function buildRelevanceRequest(query: string, head: readonly SearchResult[]): RelevanceRequest;
 /** Builds a Jev reranker around the reranker it degrades to. Exported so a test can pass a stand-in. */
 export declare function createJevReranker(localFallback: RerankerFn): RerankerFn;
+/** Orders `head` by `scores[i]`, keeping any upstream pre-rerank rank. Shared with CLEF. */
+export declare function rankByScores(head: readonly SearchResult[], scores: readonly number[]): RerankResult[];
 /** Track 4 reranker: hosted TypeSafe Jev, opt-in and paid (TYPESAFE_API_KEY), one batched call per recall.
  *  Any failure warns once and delegates to the local cross-encoder. Scores are not bit-stable run to run.
  *  Cost, env vars, evidence and limits: docs/evals/2026-09-19-jev-reranker.md. */

package/dist/rerankers/jev.js

@@ -1,5 +1,6 @@
 import { crossEncoderReranker } from './cross-encoder.js';
-import { redactSecrets } from '../secret-detect.js';
+import { redactSecretsStrict } from '../secret-detect.js';
+import { log } from '../log.js';
 const ENDPOINT = 'https://api.typesafe.ai/v1/systemone';
 const DEFAULT_TIMEOUT_MS = 5_000;
 const TRUNCATE_CHARS = 1200;
@@ -28,13 +29,11 @@ function parseScores(answers, n) {
     }
     return out;
 }
-/** One batched request for the whole candidate list. Rejects with the reason when there are no usable scores. */
-async function requestScores(query, head) {
-    const key = process.env.TYPESAFE_API_KEY;
-    if (!key)
-        throw new Error('TYPESAFE_API_KEY not set');
-    const lines = head.map((r, i) => `[${i + 1}] ${truncate(redactSecrets(r.entry.content), TRUNCATE_CHARS)}`);
-    const state = `Query: ${redactSecrets(query)}\n\nNumbered candidate memories from an AI coding agent's project store:\n\n${lines.join('\n\n')}`;
+/** Redacted query plus numbered, redacted, truncated candidates. Shared with CLEF so both arms see matched input. */
+export function buildRelevanceRequest(query, head) {
+    // Strict: this text leaves the machine, so Bearer, Basic-auth and JWT shapes go too.
+    const lines = head.map((r, i) => `[${i + 1}] ${truncate(redactSecretsStrict(r.entry.content), TRUNCATE_CHARS)}`);
+    const state = `Query: ${redactSecretsStrict(query)}\n\nNumbered candidate memories from an AI coding agent's project store:\n\n${lines.join('\n\n')}`;
     const questions = {};
     for (let i = 1; i <= head.length; i++) {
         questions[`c${i}`] = {
@@ -42,6 +41,14 @@ async function requestScores(query, head) {
             instructions: `Probability that candidate ${i} (numbered in the state above) helps answer the query.`,
         };
     }
+    return { state, questions };
+}
+/** One batched request for the whole candidate list. Rejects with the reason when there are no usable scores. */
+async function requestScores(query, head) {
+    const key = process.env.TYPESAFE_API_KEY;
+    if (!key)
+        throw new Error('TYPESAFE_API_KEY not set');
+    const { state, questions } = buildRelevanceRequest(query, head);
     const parsed = Number.parseInt(process.env.HIPPO_JEV_TIMEOUT_MS ?? '', 10);
     const timeoutMs = parsed > 0 ? parsed : DEFAULT_TIMEOUT_MS;
     const controller = new AbortController();
@@ -96,23 +103,26 @@ export function createJevReranker(localFallback) {
             if (!warned) {
                 warned = true;
                 const reason = err instanceof Error ? err.message : 'unknown error';
-                // eslint-disable-next-line no-console
-                console.warn(`[hippo] jev reranker unavailable (${reason}); falling back to the local cross-encoder. Subsequent calls will not repeat this warning.`);
+                log.warn(`jev reranker unavailable (${reason}); falling back to the local cross-encoder. Subsequent calls will not repeat this warning.`);
             }
             return localFallback(query, head, options);
         }
-        const scored = head.map((r, i) => ({
-            ...r,
-            rerankScore: scores[i],
-            preRerankRank: r.preRerankRank ?? i + 1,
-            postRerankRank: 0,
-        }));
-        // Stable sort: ties fall back to the prior relevance order.
-        scored.sort((a, b) => b.rerankScore - a.rerankScore);
-        scored.forEach((r, i) => (r.postRerankRank = i + 1));
-        return scored;
+        return rankByScores(head, scores);
     };
 }
+/** Orders `head` by `scores[i]`, keeping any upstream pre-rerank rank. Shared with CLEF. */
+export function rankByScores(head, scores) {
+    const scored = head.map((r, i) => ({
+        ...r,
+        rerankScore: scores[i],
+        preRerankRank: r.preRerankRank ?? i + 1,
+        postRerankRank: 0,
+    }));
+    // Stable sort: ties fall back to the prior relevance order.
+    scored.sort((a, b) => b.rerankScore - a.rerankScore);
+    scored.forEach((r, i) => (r.postRerankRank = i + 1));
+    return scored;
+}
 /** Track 4 reranker: hosted TypeSafe Jev, opt-in and paid (TYPESAFE_API_KEY), one batched call per recall.
  *  Any failure warns once and delegates to the local cross-encoder. Scores are not bit-stable run to run.
  *  Cost, env vars, evidence and limits: docs/evals/2026-09-19-jev-reranker.md. */

package/dist/rerankers/llm.js

@@ -1,4 +1,4 @@
-import { redactSecrets } from '../secret-detect.js';
+import { redactSecretsStrict } from '../secret-detect.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
 /**
  * Track 3 reranker: listwise LLM rerank. Uses a customer-supplied
@@ -22,8 +22,8 @@ export const llmReranker = async (query, results, options) => {
     const head = results.slice(0, topK);
     const prompt = [
         `Rerank the candidates below by relevance to the query. Output a JSON array of indices (zero-indexed) in best-first order.`,
-        `Query: ${redactSecrets(query)}`,
-        ...head.map((r, i) => `[${i}] ${redactSecrets(r.entry.content)}`),
+        `Query: ${redactSecretsStrict(query)}`,
+        ...head.map((r, i) => `[${i}] ${redactSecretsStrict(r.entry.content)}`),
         `Output format: [<int>, <int>, ...] with all ${head.length} indices.`,
     ].join('\n');
     const timeoutMs = Number.parseInt(process.env.HIPPO_LLM_RERANKER_TIMEOUT_MS ?? '', 10) || DEFAULT_TIMEOUT_MS;

package/dist/rerankers/types.d.ts

@@ -26,6 +26,20 @@ export interface RerankerOptions {
     /** Per-track config blob; opaque to the seam. */
     config?: Record<string, RerankerConfigValue>;
 }
+/** Which backend and model produced a rerank, or why it fell back. */
+export interface RerankProvenance {
+    /** `cloudflare`, `private-endpoint`, or `native` when the input order was kept. */
+    backend: 'cloudflare' | 'private-endpoint' | 'native';
+    /** Model the caller asked for. */
+    requestedModel: string;
+    /** Model the provider says scored the request, when it reports one. */
+    actualModel?: string;
+    /** Set when the input order was kept instead of a model ranking. */
+    fallbackReason?: string;
+    /** Provider-reported token usage, when sent. */
+    inputTokens?: number;
+    outputTokens?: number;
+}
 export interface RerankResult extends SearchResult {
     /** Score assigned by the reranker. Replaces `score` for downstream
      *  ordering; original `score` preserved on the SearchResult. */
@@ -34,5 +48,7 @@ export interface RerankResult extends SearchResult {
     preRerankRank: number;
     /** 1-indexed rank in the reranker output. */
     postRerankRank: number;
+    /** Recorded by rerankers that track model identity (the CLEF rerankers). */
+    rerankProvenance?: RerankProvenance;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/same-text.d.ts

@@ -10,6 +10,8 @@ export declare function mergedText(header: string, texts: readonly string[]): st
 export declare function heldTexts(entry: Text): string[];
 /** Keys of every text a row holds word for word: its own, plus each source text inside a sleep-merged row. */
 export declare function heldTextKeys(entry: Text): string[];
+/** The longest word of a text: every row holding the text word for word contains it, so a store lookup can filter on it. */
+export declare function longestWord(text: string): string;
 export declare function storedTextKeys(entries: readonly Text[]): Set<string>;
 /** A final result list without copies: drops each unpinned row a sleep-merged row in the list holds word for word, and each later unpinned copy of a text. */
 export declare function dropHeldCopies<T>(rows: readonly T[], textOf: (row: T) => Text): T[];

package/dist/same-text.js

@@ -19,6 +19,10 @@ export function heldTexts(entry) {
 export function heldTextKeys(entry) {
     return [duplicateKey(entry.content), ...heldTexts(entry).map(duplicateKey)];
 }
+/** The longest word of a text: every row holding the text word for word contains it, so a store lookup can filter on it. */
+export function longestWord(text) {
+    return duplicateKey(text).split(' ').reduce((best, w) => (w.length > best.length ? w : best), '');
+}
 export function storedTextKeys(entries) {
     return new Set(entries.flatMap(heldTextKeys));
 }

package/dist/scheduler.js

@@ -38,6 +38,7 @@ export function loadWorkspaceRegistry(globalRoot) {
         };
     }
     catch {
+        // A missing or corrupt registry starts empty; the next registration rewrites it.
         return defaultRegistry();
     }
 }

package/dist/search.js

@@ -640,7 +640,8 @@ export async function physicsSearch(query, entries, options = {}) {
             const [vec] = await provider.embed([query], 'query');
             queryVector = vec ?? [];
         }
-        catch {
+        catch (err) {
+            log.debug(`physics search: query embed failed, using hybrid: ${err instanceof Error ? err.message : String(err)}`);
             return hybridSearch(query, entries, options);
         }
         if (queryVector.length === 0) {
@@ -658,7 +659,8 @@ export async function physicsSearch(query, entries, options = {}) {
             closeHippoDb(db);
         }
     }
-    catch {
+    catch (err) {
+        log.debug(`physics search: state load failed, using hybrid: ${err instanceof Error ? err.message : String(err)}`);
         return hybridSearch(query, entries, options);
     }
     // Split entries into physics-enabled and classic

package/dist/secret-detect.js

@@ -124,6 +124,7 @@ export function redactPayload(raw) {
         JSON.parse(raw);
     }
     catch {
+        // Not JSON, so there is no structure to keep valid; redact the raw text.
         return redactSecretsStrict(raw);
     }
     return raw.replace(JSON_STRING, (literal) => {

package/dist/server.d.ts

@@ -1,6 +1,9 @@
 import { type IncomingMessage } from 'node:http';
 /** Test-only: reset the module-level recall-history Map. Call from beforeEach. */
 export declare function __resetSessionRecallHistoryHttp(): void;
+import { authRevoke, type Actor, type Context } from './api.js';
+import { ForbiddenError } from './api-errors.js';
+export { authRevoke, ForbiddenError, type Context, type Actor };
 export interface ServerHandle {
     port: number;
     url: string;
@@ -15,7 +18,7 @@ export interface ServerHandle {
 export interface ResolvedBearer {
     tenantId: string;
     subject: string;
-    /** Not 'admin' means 'member'. Admin is tenant-only, yet can mint member API keys (POST /v1/auth/keys) that outlive IdP deprovisioning. */
+    /** Not 'admin' means 'member'. Admin is tenant-only, yet can mint member API keys (POST /v1/auth/keys); an add-on revokes them through the exported authRevoke when the IdP deprovisions the minter. */
     role: 'admin' | 'member';
     scopes?: readonly string[];
 }
@@ -56,6 +59,8 @@ export declare function isCrossSite(req: IncomingMessage): boolean;
  * bucket per request and bypass the limiter entirely.
  */
 export declare function clientIpForRateLimit(req: IncomingMessage): string;
+/** Add-ons call this to refuse a subject that would collide with a built-in actor. */
+export declare function isReservedActor(subject: string): boolean;
 /**
  * Boot the HTTP daemon on host:port and write the pidfile under hippoRoot.
  *

package/dist/server.js

@@ -1,11 +1,12 @@
 import { createServer } from 'node:http';
 import { createHash, randomUUID } from 'node:crypto';
+import { existsSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { resolveProjectIdentity } from './project-identity.js';
 import { assembleCost, contextCost, drillCost } from './context-render.js';
 import { detectServer, writePidfile, removePidfileIfOwned } from './server-detect.js';
 import { resolveTenantId } from './tenant.js';
-import { openHippoDb, closeHippoDb } from './db.js';
+import { openHippoDb, closeHippoDb, getHippoDbPath } from './db.js';
 import { updateStats } from './store.js';
 import { buildSessionKey, getOrCreateRing, appendRecall, snapshotRing, hashQueryText, biasHintEnabled, } from './recall-history.js';
 import { appendAuditEvent, auditQueryFields, auditWriteFailureCount, AUDIT_OPS } from './audit.js';
@@ -35,11 +36,13 @@ import { savePolicy, closePolicy, loadPolicyById, loadPolicies, loadPoliciesAsOf
 import { saveSkill, closeSkill, loadSkillById, loadSkills, exportSkills, VALID_SKILL_STATES, } from './skills.js';
 import { saveProjectBrief, closeProjectBrief, loadProjectBriefById, loadProjectBriefs, assembleBriefFromReceipts, refreshBrief, VALID_BRIEF_STATES, } from './project-briefs.js';
 import { saveCustomerNote, closeCustomerNote, loadCustomerNoteById, loadCustomerNotes, VALID_NOTE_STATES, } from './customer-notes.js';
-import { handleMcpRequest } from './mcp/server.js';
+import { handleMcpRequest, mcpErrorResponse } from './mcp/server.js';
 import { handleSlackEventsWebhook } from './connectors/slack/webhook.js';
 import { handleGitHubEventsWebhook } from './connectors/github/webhook.js';
 import { HttpError, JSON_HEADERS, BodyTooLargeError, isHeaderString, isJsonObjectRecord, mapApiError, readBody, sendJson, } from './http-util.js';
-import { NotFoundError } from './api-errors.js';
+import { ForbiddenError, NotFoundError } from './api-errors.js';
+// Add-on packages revoke keys through these without importing the whole api surface.
+export { authRevoke, ForbiddenError };
 // Review patch #2: explicit allow-list for unauthenticated /v1/* routes.
 // New unauth routes MUST be added here AND get a corresponding entry in
 // tests/server-bearer-lockdown.test.ts. Do not gate auth elsewhere by
@@ -364,6 +367,11 @@ export function clientIpForRateLimit(req) {
 const RESERVED_ACTOR_NAMES = [
     'api_key', 'localhost', 'cli', 'system', 'mcp', 'connector', 'sleep', 'post-compact', 'recall', 'agent-memories',
 ];
+/** Add-ons call this to refuse a subject that would collide with a built-in actor. */
+export function isReservedActor(subject) {
+    const lower = subject.toLowerCase();
+    return RESERVED_ACTOR_NAMES.some((n) => lower === n || lower.startsWith(`${n}:`));
+}
 function hasControlChar(s) {
     for (let i = 0; i < s.length; i++) {
         const c = s.charCodeAt(i);
@@ -388,8 +396,7 @@ function sanitiseResolved(r) {
     // Padding would let "system " pass the reserved-name check yet read as `system` in an audit log.
     if (hasControlChar(subject) || subject !== subject.trim())
         return null;
-    const lower = subject.toLowerCase();
-    if (RESERVED_ACTOR_NAMES.some((n) => lower === n || lower.startsWith(`${n}:`)))
+    if (isReservedActor(subject))
         return null;
     const clean = { tenantId: tenant, subject, role: role === 'admin' ? 'admin' : 'member' };
     if (Array.isArray(scopes))
@@ -398,8 +405,7 @@ function sanitiseResolved(r) {
 }
 function logResolverFailure(what, raw, token) {
     // The plugin's message is logged, but never the token, even if the plugin echoed it.
-    const msg = raw.split(token).join('[token]').replace(/[\r\n]/g, ' ');
-    process.stderr.write(`[hippo] auth resolver ${what}: ${msg}\n`);
+    log.error(`auth resolver ${what}: ${raw.split(token).join('[token]')}`);
 }
 /** 503 when upstream throws or misses the deadline, so a stream heartbeat can tell an outage from a revocation. */
 async function askResolver(resolver, token, deadlineMs) {
@@ -2408,11 +2414,7 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
             });
         }
         catch (err) {
-            mcpRes = {
-                jsonrpc: '2.0',
-                id: mcpReq.id,
-                error: { code: -32603, message: err instanceof Error ? err.message : 'internal error' },
-            };
+            mcpRes = mcpErrorResponse(rpcReq.id, err, requestIds.get(req));
         }
         if (mcpRes === null) {
             // Notification — no body, 202 Accepted.
@@ -2487,7 +2489,7 @@ async function handleRequest(req, res, opts, startedAt, limiter) {
                     res.write(': ping\n\n');
                 }
                 catch {
-                    clearInterval(ping);
+                    clearInterval(ping); // the client hung up; stop pinging a dead socket
                 }
             });
         }, heartbeatMs);
@@ -2555,7 +2557,23 @@ export async function serve(opts) {
     const limiter = Number.isFinite(v1Rps) && v1Rps > 0
         ? createRateLimiter({ ratePerSec: v1Rps, burst: v1Rps * 2, idleEvictMs: 60000, maxKeys: 10000 })
         : undefined;
+    // Handlers open and close their own connections; while this one is held, none of those closes is SQLite's last,
+    // which checkpoints and deletes the WAL. It opens only once the store exists, so serving never creates one.
+    let heldDb;
+    let stopHolding = false;
+    const holdStore = () => {
+        if (heldDb || stopHolding || !existsSync(getHippoDbPath(opts.hippoRoot)))
+            return;
+        try {
+            heldDb = openHippoDb(opts.hippoRoot);
+        }
+        catch (err) {
+            stopHolding = true;
+            log.warn(`serve: could not hold a store connection; requests still work, only slower: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    };
     const server = createServer((req, res) => {
+        res.once('finish', holdStore);
         const requestId = resolveRequestId(req.headers['x-request-id']);
         requestIds.set(req, requestId);
         res.setHeader('X-Request-Id', requestId);
@@ -2622,6 +2640,7 @@ export async function serve(opts) {
     const actualPort = addressInfo.port;
     const url = `http://${host}:${actualPort}`;
     writePidfile(opts.hippoRoot, { port: actualPort, url, startedAt });
+    holdStore();
     let stopping = false;
     const stop = async () => {
         if (stopping)
@@ -2639,6 +2658,10 @@ export async function serve(opts) {
         await new Promise((resolve) => {
             server.close(() => resolve());
         });
+        stopHolding = true;
+        if (heldDb)
+            closeHippoDb(heldDb);
+        heldDb = undefined;
     };
     if (opts.handleSignals) {
         let shuttingDown = false;
@@ -2646,12 +2669,12 @@ export async function serve(opts) {
             if (shuttingDown)
                 return;
             shuttingDown = true;
-            console.error(`Received ${signal}, shutting down...`);
+            log.warn(`received ${signal}, shutting down`);
             try {
                 await stop();
             }
             catch (err) {
-                console.error('Error during stop:', err);
+                log.error(`error during stop: ${err instanceof Error ? err.message : String(err)}`);
             }
             finally {
                 process.exit(0);

package/dist/shared.js

@@ -9,7 +9,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { generateId, COMPACTION_MEMORY_TAG } from './memory.js';
 import { AGENT_MEMORY_SOURCE_PREFIX, AGENT_MEMORY_TAGS } from './agent-memories/tools.js';
-import { initStore, loadAllEntries, loadIndex, loadSearchEntries, loadRecallSearchEntries, writeEntry, readEntry, } from './store.js';
+import { initStore, loadAllEntries, loadIndex, loadSearchEntries, loadRecallSearchEntries, tallySources, writeEntry, readEntry, } from './store.js';
 import { passesScopeFilterForRecall, passesCliRecallScopeFilter } from './recall-scope.js';
 import { search, hybridSearch, fitBudget } from './search.js';
 import { evalNow } from './ablation.js';
@@ -19,6 +19,11 @@ import { isQuarantineScope } from './quarantine.js';
 import { RejectedValueError } from './rejection.js';
 import { embedMemory, embedAll } from './embeddings.js';
 import { duplicateKey, storedTextKeys } from './same-text.js';
+import { log } from './log.js';
+// The rows are already copied; a failed background embed only delays vectors, so it warns instead of throwing.
+function logEmbedAllFailure(caller, err) {
+    log.warn(`${caller}: background embed failed (${err instanceof Error ? err.message : String(err)}); run 'hippo embed' to backfill`);
+}
 /**
  * Returns the path to the global Hippo store.
  * Resolution order: $HIPPO_HOME > $XDG_DATA_HOME/hippo > ~/.hippo/
@@ -330,32 +335,29 @@ export function listPeers(globalRoot, tenantId) {
         return [];
     // D4: tenant-scoped by default when tenantId provided. Host-wide when
     // undefined (preserves back-compat).
-    const allEntries = loadAllEntries(root);
-    const entries = tenantId !== undefined
-        ? allEntries.filter((e) => e.tenantId === tenantId)
-        : allEntries;
+    const tallies = tallySources(root, tenantId).sort((a, b) => (a.first < b.first ? -1 : a.first > b.first ? 1 : 0));
     const peerMap = new Map();
-    for (const entry of entries) {
+    for (const tally of tallies) {
         let project = 'unknown';
-        if (entry.source.startsWith('shared:')) {
-            const parts = entry.source.split(':');
+        if (tally.source.startsWith('shared:')) {
+            const parts = tally.source.split(':');
             project = parts[1] || 'unknown';
         }
-        else if (entry.source.startsWith('promoted:')) {
-            const promotedPath = entry.source.slice('promoted:'.length);
+        else if (tally.source.startsWith('promoted:')) {
+            const promotedPath = tally.source.slice('promoted:'.length);
             project = path.basename(path.resolve(promotedPath, '..'));
         }
-        else if (entry.source === 'cli-global') {
+        else if (tally.source === 'cli-global') {
             project = 'global-cli';
         }
         const existing = peerMap.get(project);
         if (!existing) {
-            peerMap.set(project, { count: 1, latest: entry.created });
+            peerMap.set(project, { count: tally.count, latest: tally.latest });
         }
         else {
-            existing.count++;
-            if (entry.created > existing.latest)
-                existing.latest = entry.created;
+            existing.count += tally.count;
+            if (tally.latest > existing.latest)
+                existing.latest = tally.latest;
         }
     }
     return Array.from(peerMap.entries())
@@ -458,10 +460,10 @@ export function autoShare(localRoot, options = {}) {
         }
     }
     if (rejectedSkipped > 0) {
-        console.error(`autoShare: skipped ${rejectedSkipped} candidate(s) refused by the global store's rejection tombstone`);
+        log.warn(`autoShare: skipped ${rejectedSkipped} candidate(s) refused by the global store's rejection tombstone`);
     }
     if (shared.length > 0) {
-        void embedAll(globalRoot).catch(() => { });
+        void embedAll(globalRoot).catch((err) => logEmbedAllFailure('autoShare', err));
     }
     return shared;
 }
@@ -516,12 +518,12 @@ export function syncGlobalToLocal(localRoot, globalRoot, opts = {}) {
         count++;
     }
     if (rejected > 0) {
-        console.error(`syncGlobalToLocal: skipped ${rejected} rejected value(s) (run \`hippo unreject\` on the local store to allow).`);
+        log.warn(`syncGlobalToLocal: skipped ${rejected} rejected value(s) (run \`hippo unreject\` on the local store to allow).`);
     }
     // Batch producer: one embedAll() on the destination rather than an
     // embedMemory() per copied row (same batching invariant as autoShare).
     if (count > 0) {
-        void embedAll(localRoot).catch(() => { });
+        void embedAll(localRoot).catch((err) => logEmbedAllFailure('syncGlobalToLocal', err));
     }
     return count;
 }

package/dist/stdin.js

@@ -11,6 +11,7 @@ export function readStdinBounded(waitMs = defaultWaitMs()) {
         stdin = process.stdin;
     }
     catch {
+        // Reading process.stdin can throw when the handle is closed; that is the same as no input.
         return Promise.resolve({ timedOut: false });
     }
     if (stdin.isTTY)

package/dist/store.d.ts

@@ -4,7 +4,7 @@
  * SQLite is the source of truth.
  * Markdown + JSON files remain as human-readable compatibility mirrors.
  */
-import { MemoryEntry, Layer } from './memory.js';
+import { MemoryEntry, Layer, type StrengthInputs } from './memory.js';
 import { openHippoDb, getHippoDbPath, type DatabaseSyncLike } from './db.js';
 import { SessionHandoff, HandoffEvidence, HandoffOutcome } from './handoff.js';
 import { type ResolveProjectIdentityOpts } from './project-identity.js';
@@ -76,6 +76,7 @@ export interface SessionEvent {
     metadata: Record<string, JsonValue>;
     created_at: string;
 }
+export declare const MEMORY_SELECT_COLUMNS = "id, created, last_retrieved, retrieval_count, strength, half_life_days, layer, tags_json, emotional_valence, schema_fit, source, outcome_score, outcome_positive, outcome_negative, conflicts_with_json, pinned, confidence, content, parents_json, starred, trace_outcome, source_session_id, valid_from, superseded_by, extracted_from, dag_level, dag_parent_id, kind, scope, owner, artifact_ref, tenant_id, origin_project, descendant_count, earliest_at, latest_at, summary_dirty, last_rebuilt_at, rebuild_count, dag_level_3_built_at";
 /**
  * Default candidate-pool size for `loadSearchEntries` when called with
  * `limit === undefined`. Single source of truth; `api.recall` imports
@@ -413,7 +414,38 @@ export interface AmbientLoadResult {
     entries: MemoryEntry[];
     recall?: MemoryEntry[];
 }
+/** Exported so the plan test runs the exact SQL; idx_memories_pinned (db.ts v51) serves it. */
+export declare const AMBIENT_PINNED_WHERE = "pinned = 1 AND superseded_by IS NULL AND tenant_id = ? ORDER BY created ASC, id ASC";
+/** Exported so the plan test runs the exact SQL; idx_memories_created_drift (db.ts v51) serves it. */
+export declare const AMBIENT_DRIFT_SQL = "SELECT 1 FROM memories WHERE superseded_by IS NULL AND tenant_id = ? AND (length(created) <> 24 OR created NOT LIKE '%Z') LIMIT 1";
 export declare function loadAmbientCandidates(hippoRoot: string, tenantId: string, recentNeeded: number, admit: (e: MemoryEntry) => boolean, recall?: AmbientRecallRequest): AmbientLoadResult;
+/** The rows a non-pinned context read may admit; each predicate is one getContext's admission applies again in JS. */
+export interface ContextCandidateFilter {
+    /** Envelope scope asked for by name; absent applies recall's default deny. */
+    exactScope?: string;
+    /** Rows of this project and user-global rows pass; absent admits every origin. */
+    project?: string;
+    /** Most rows returned; past it, the rows decay has worn least win. */
+    cap: number;
+    now: Date;
+}
+/** Live tenant rows passing `filter`, at most `filter.cap`, in loadAllEntries' order; below the cap, every such row. */
+export declare function loadContextCandidates(hippoRoot: string, tenantId: string, filter: ContextCandidateFilter): MemoryEntry[];
+/** A row's strength inputs and tags, without its text or the JSON lists a full row parses. */
+export type StrengthRow = StrengthInputs & Pick<MemoryEntry, 'tags'>;
+/** Every tenant row as a StrengthRow, for whole-store health numbers; defaults match rowToEntry's. */
+export declare function loadStrengthRows(hippoRoot: string, tenantId: string): StrengthRow[];
+/** Text and source of tenant rows holding any of `words`; a row equal to a text apart from spacing holds its every word. */
+export declare function loadTextsHoldingWords(hippoRoot: string, tenantId: string, words: readonly string[]): Array<Pick<MemoryEntry, 'content' | 'source'>>;
+export interface SourceTally {
+    source: string;
+    count: number;
+    latest: string;
+    /** `created`, a unit separator, then `id` of the source's first row in loadAllEntries' order. */
+    first: string;
+}
+/** Row count and newest `created` per source, for peer listings that need no row; all tenants when `tenantId` is absent. */
+export declare function tallySources(hippoRoot: string, tenantId?: string): SourceTally[];
 /**
  * Load likely search candidates directly from SQLite.
  * Uses FTS5 when available, falls back to LIKE matching, then full-store fallback.